Posts Tagged ‘linux memory forensics’

A member of GitHub ‘meirwah’ has shared the good list of incident response sources (such us: tools, books, videos, communities, etc.).

N1GH7M4R3 has shared short and clearly overview of Linux File System.

He has described all system folders of the file system.

There are several methods of acquiring a memory image from a Linux system – one of the most traditional being to image the current physical memory into a single file – In this case any non-system areas would need to be padded with zeros in order to maintain the representation of physical memory. Another method involves examining the /proc/iomem file (Linux will print the current map of the systems memory in this file) to identify which memory ranges are marked as System RAM, and copying / concatenating those ranges into one file. This results in a smaller file, but lacks the representation of physical memory.

The problem we have and the reason this article and Python code has [...]

With release of such tools as Volatility, acquiring RAM images becomes really useful.